#!/bin/bash
## compile openssh
## modify by winkill 20201225
## ## default version ##
## el6 5.3p1
## el7 7.4p1
# -------------------------

THREAD=$(grep 'processor' /proc/cpuinfo | sort -u | wc -l)
yum -y install pam-devel

# install zlib
tar zxvf zlib-1.2.11.tar.gz
cd zlib-1.2.11
./configure --prefix=/usr
make -j ${THREAD}
rpm -e --nodeps zlib
make install
ldconfig -v|grep libz
ll /usr/lib/libz.*
cd ..
# install openssl
mv  /usr/lib64/openssl /usr/lib64/openssl.old
mv  /usr/bin/openssl  /usr/bin/openssl.old
mv  /etc/pki/ca-trust/extracted/openssl  /etc/pki/ca-trust/extracted/openssl.old
cp  /usr/lib64/libcrypto.so.10  /usr/lib64/libcrypto.so.10.old
cp  /usr/lib64/libcrypto.so.1.1  /usr/lib64/libcrypto.so.1.1.old
cp  /usr/lib64/libssl.so.10  /usr/lib64/libssl.so.10.old
cp  /usr/lib64/libssl.so.1.0.1e /usr/lib64/libssl.so.1.0.1e.old
rpm -e `rpm -qa | grep openssl` --nodeps
tar zxvf openssl-1.1.1i.tar.gz 
cd openssl-1.1.1i
./config --prefix=/usr --openssldir=/etc/ssl --shared zlib
make -j ${THREAD}
make install
openssl version -a 
cd ..
## install openssh 
mv /etc/ssh /etc/ssh.old
mv /etc/pam.d/sshd /etc/pam.d/sshd.old 
rpm -qa |grep openssh|xargs -i rpm -e --nodeps {}

#install  -v -m700 -d /var/lib/sshd
#chown  -v root:sys /var/lib/sshd
#groupadd -g 50 sshd
#useradd  -c 'sshd PrivSep' -d /var/lib/sshd -g sshd -s /bin/false -u 50 sshd
tar zxvf openssh-8.9p1.tar.gz 
cd openssh-8.9p1
./configure --prefix=/usr  --sysconfdir=/etc/ssh  --with-md5-passwords  --with-pam  --with-zlib  --with-privsep-path=/var/empty/sshd
make -j ${THREAD}
make install

# after
install -v -m755    contrib/ssh-copy-id /usr/bin
install -v -m644    contrib/ssh-copy-id.1 /usr/share/man/man1
install -v -m755 -d /usr/share/doc/openssh-8.9p1
install -v -m644    INSTALL LICENCE OVERVIEW README* /usr/share/doc/openssh-8.9p1
ssh -V
 
# settings
echo 'X11Forwarding yes' >> /etc/ssh/sshd_config
echo "PermitRootLogin yes" >> /etc/ssh/sshd_config
echo "ChallengeResponseAuthentication no" >> /etc/ssh/sshd_config
echo "UsePAM yes" >> /etc/ssh/sshd_config

## low version ssh to high version sshd by add rsa on sshd config
echo "HostKeyAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config
## high version ssh to low version sshd by add dss on ssh config
{
cat <<'XUNLEI'
Host *
        HostKeyAlgorithms +ssh-dss
XUNLEI
} >> /etc/ssh/ssh_config

# auto ssh mianmi high version ssh to low version sshd 
echo "PubkeyAcceptedKeyTypes +ssh-rsa" >> /etc/ssh/ssh_config
# auto ssh mianmi low version to high version sshd
echo "PubkeyAcceptedAlgorithms +ssh-rsa" >> /etc/ssh/sshd_config

cp /etc/pam.d/sshd.old /etc/pam.d/sshd
cp -p contrib/redhat/sshd.init /etc/init.d/sshd
chmod +x /etc/init.d/sshd
chkconfig  --add  sshd
chkconfig  sshd  on
chkconfig  --list  sshd
service sshd start
#注意：如果升级操作一直是在ssh远程会话中进行的，上述sshd
